---
title: "Patch binding permission rules"
method: PATCH
path: "/toolkits/{toolkit_id}/credentials/{credential_id}/permissions"
tags: ["Toolkit Permissions"]
---

# Patch binding permission rules

`PATCH /toolkits/{toolkit_id}/credentials/{credential_id}/permissions`

Additively add and/or remove permission rules on a binding.

## Path parameters

- `toolkit_id` string, required
- `credential_id` string, required

## Request body

- PermissionsPatchRequest — Patch permission rules — add and/or remove.
  - `add` JenticOneControlWebSchemasToolkitsPermissionRuleSchema[], nullable
    - `effect` 'allow' | 'deny', required — Whether this rule allows or denies the matched request.
    - `match_mode` 'regex' | 'prefix' | 'exact' — How `path` is interpreted: `regex` (full-match), `prefix` (string prefix), or `exact` (equality). Defaults to `regex` for backwards compatibility.
    - `methods` string[], nullable — HTTP methods to match (case-insensitive). None matches all.
    - `operations` string[], nullable — OpenAPI operation IDs to match. None matches all operations.
    - `path` string, nullable — Path pattern to match. Interpreted per `match_mode`: `regex` uses full-match semantics (the pattern must describe the whole path); `prefix` and `exact` are literal. None matches all paths.
  - `remove` integer[], nullable

## Response `200`

Successful Response

- PermissionRuleListResponse — List of permission rules.
  - `data` PermissionRuleReadSchema[], required
    - `_comment` string, nullable
    - `_system` boolean
    - `effect` 'allow' | 'deny', required
    - `match_mode` 'regex' | 'prefix' | 'exact'
    - `methods` string[], nullable
    - `operations` string[], nullable
    - `path` string, nullable

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `422` — Unprocessable Entity
- `500` — Internal Server Error
- `503` — Service Unavailable

## Changes

- **2026-07-24** `6b93e5cc002c` — 2 info
  - added the new optional request property `add/anyOf[subschema #1]/items/match_mode`
  - added the optional property `data/items/match_mode` to the response with the `200` status
- **2026-04-13** `76e8f6063728` — 8 breaking, 6 warning, 11 info
  - request property `add` list-of-types was narrowed by removing types `null` from media type `application/json`
  - request property `remove` list-of-types was narrowed by removing types `null` from media type `application/json`
  - the response's body type/format changed from `object`/`` to `array`/`` for status `200`
  - media type `application/problem+json` was changed to a more general media type `application/json` for the response status `422`
  - …21 more

[Change history](https://skmtc.dev/jentic/apis/jentic-control-plane-api/changes/toolkits/:toolkit_id/credentials/:credential_id/permissions/patch.md)

---

[API](https://skmtc.dev/jentic/apis/jentic-control-plane-api.md) · [All operations](https://skmtc.dev/jentic/apis/jentic-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/jentic/jentic-control-plane-api/revisions/dceddff07ff7/schema)